Compare Hostinger and Scaleway on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Lithuania· Cloud Computing
Needs review
Shortlist Hostinger when you want managed WordPress or a simple KVM VPS with an EU data-center option and a published DPA. Skip it when you need HIPAA or PCI, an EU-only data path, or a custom enterprise SLA. Consider Hetzner or OVHcloud instead for more operator-centric European infrastructure.
France· Cloud Computing
Needs review
Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.
Highlighted rows differ between the two products.
| Feature | Hostinger | Scaleway |
|---|---|---|
| Country of origin | Lithuania | France |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Lithuania | France |
| Legal entity | EU customers: Hostinger International Ltd (Cyprus). Affiliates: HOSTINGER, UAB and HOSTINGER operations, UAB (Vilnius). Also Hostinger UK Limited and Hostinger Global S.a r.l. (Luxembourg). | SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris |
| Governing law | Not listed | French law (General Terms of Services) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Customer-chosen DCs: FR, DE, LT, NL, UK plus US (Phoenix, Boston, Asheville), Brazil, India, Indonesia, Malaysia (plan-dependent). DPA subprocessors include AWS EMEA SARL, Google Cloud EMEA Limited, Cloudflare, Inc., MailChannels, Proofpoint, Inc., Anthropic Ireland, and spectra tech UAB. Privacy policy also names Google Analytics, Meta ads, Ravelin, and iDenfy. | Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page. |
| Summary | Lithuania-founded web hosting for WordPress, managed cloud, and KVM VPS, with selectable European data centers and Cyprus contracting for EU customers. | French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe. |
| Tags |
| At a glance | Hostinger | Scaleway |
|---|---|---|
| HQ / operations | Vilnius, Lithuania (also Kaunas; Yogyakarta office) | Not listed |
| EU contracting entity | Hostinger International Ltd (Larnaca, Cyprus) | Not listed |
| Founded | 2004 as Hosting Media; Hostinger brand in 2011 | Not listed |
| Product shape | Managed web/WordPress, managed cloud, KVM VPS, domains, email | Not listed |
| Open source / self-host | Neither. Proprietary platform; VPS guests are customer-managed | Not listed |
| Commercial model | Prepaid subscription with auto-renew; 30-day money-back on eligible hosting | Pay-as-you-go; compute Savings Plans (GPU rules differ) |
| HQ | Not listed | Paris, France (SCALEWAY SAS) |
| Group | Not listed | iliad Group subsidiary |
| Regions | Not listed | Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed) |
| Model | Not listed | Public cloud IaaS/PaaS (not self-hosted) |
| Open source | Not listed | Platform proprietary; open standards (K8s, S3 API, Terraform) |
| Key capabilities | Hostinger | Scaleway |
|---|---|---|
| EU-operated (Cyprus contract) | Yes | Yes |
| ISO 27001 (claimed) | Yes | Yes |
| Managed WordPress | Yes | Not listed |
| KVM VPS + public API | Yes | Not listed |
| Public DPA | Yes | Not listed |
| Selectable EU data centers | Yes | Not listed |
| Bare metal + Elastic Metal | Not listed | Yes |
| EU GPU for AI | Not listed | Yes |
| Kapsule Kubernetes | Not listed | Yes |
| HDS (claimed) | Not listed | Yes |
Selectable European and global data centers
Web and cloud plans can be placed in France, Germany, Lithuania, the Netherlands, or the United Kingdom, or in the United States, Brazil, India, Indonesia, or Malaysia. VPS omits the Netherlands. Location is chosen at setup and can be moved later on web and cloud, but not on VPS without rebuild.
Managed WordPress on LiteSpeed and hPanel
Plans include one-click install, staging, automatic updates, malware scanning, WAF, Let's Encrypt, WP-CLI, SSH, and Git. WordPress.org lists Hostinger as a recommended host. Shared plans isolate accounts with CloudLinux LVE. Not a self-hosted WordPress appliance you run elsewhere.
KVM VPS with root, templates, and a public API
KVM guests use AMD EPYC and NVMe, weekly backups, snapshots, a managed firewall, Wanguard DDoS filtering, and one-click OS or app templates (Docker, n8n, Ubuntu, and others). A documented public API and MCP server support automation. The guest is unmanaged: you patch the OS.
Managed cloud with dedicated IP and NVMe
Cloud plans keep hPanel and add more CPU, RAM, NVMe, PHP workers, inode headroom, a dedicated IP, CDN, and daily or on-demand backups. Aimed at agencies and busier WordPress or Node.js sites that do not want root. Upgrade path from shared hosting is in-panel.
In-house hPanel, Access Manager, and migrations
hPanel is Hostinger's control plane for sites, DNS, mail, backups, and collaborators. Access Manager shares scoped access without handing over the account password. Website migration is a supported request flow for common CMS stacks. Developer tools (SSH, Git, PHP versions) live in the same panel.
Public DPA with a named sub-processor list
A click-through DPA covers hosting, VPS, email, domains, Website Builder, Horizons, and Reach. Appendix 3 lists AWS EMEA, Google Cloud EMEA, Cloudflare, MailChannels, Proofpoint, Anthropic Ireland, and spectra tech UAB. New sub-processors can be added with a 10-day objection window.
Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.
| Assurance & compliance | Hostinger | Scaleway |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor describes internal pentests and a HackerOne-style responsible disclosure programme. No public independent audit PDF found. | Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim. |
| ISO 27001 | Vendor claimed Trust Center and security article claim ISO/IEC 27001:2022. Certificate download requires Trust Center access. Not independently verified here. | Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy. |
| SOC 2 / SOC 3 | Not found No public SOC 2 or SOC 3 report found on Trust Center overview or legal pages. | Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1). |
| GDPR / EU data protection | Vendor claimed EU/UK/Luxembourg contracting entities; privacy policy cites GDPR; DPA includes EU SCCs and UK addendum. Confirm entity on the invoice. | Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice. |
| US CLOUD Act exposure (indicative) | Partial European group, no known US parent. Exposure is medium because customers may select US data centers and the DPA names US-group processors (AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint). Not legal advice. | Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim. |
| Data processing agreement (B2B) | Vendor claimed Public DPA incorporated into the Terms of Service. Parties: Hostinger International Ltd, Hostinger UK Limited, or Hostinger Global S.a r.l. | Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs. |
| EU AI Act | Not applicable Core product is hosting. Horizons, Kodee, and Reach are AI features inside that product, not an AI-centric system of record. | Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim. |
| HIPAA / PCI environment | Not applicable Hosting agreement: services are not intended to provide a PCI or HIPAA compliant environment. | Not listed |
| HDS (French health data hosting) | Not listed | Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture. |
| CSA STAR Level 1 | Not listed | Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ). |
| ANSSI SecNumCloud | Not listed | Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed. |
| Considerations & known limitations | Hostinger | Scaleway |
|---|---|---|
| Optional non-EU hosting regions | Medium US, Brazil, and Asia data centers are first-class options. An operator can place production outside the EEA at checkout. Lock region in procurement if residency is required. | Not listed |
| US-group cloud, CDN, email, and security vendors | Medium Even an EU VM still depends on AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint, MailChannels, plus Google/Meta marketing tools. This is why CLOUD Act exposure is not low. | Not listed |
| Cyprus contract vs Lithuanian operations | Low HQ and affiliates are Lithuanian; EU paper is usually Hostinger International Ltd (Cyprus). Invoices may also be charged by other group entities. Confirm the contracting party before security review. | Not listed |
| ISO 27001 certificate not independently verified here | Low The cert is claimed on the Trust Center but gated. Download it before treating ISO as verified. | Not listed |
| Customer still owns CMS, guest OS, and backups | Medium VPS is unmanaged. Terms require you to keep your own backups even when Hostinger offers weekly copies. Shared and cloud plans are not HIPAA/PCI environments. | Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes. |
| SecNumCloud not yet obtained | Not listed | Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan. |
| Smaller service catalogue than US hyperscalers | Not listed | Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate. |
| Account-plane processors and possible non-EU transfers | Not listed | Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs. |
| Dedibox vs Elastic Metal product split | Not listed | Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort. |
When: You want German-operated dedicated servers, object storage, or more operator-centric VPS without a consumer website-builder overlay
Consider: Hetzner
Hetzner is in the catalog as German web hosting and cloud.
When: You need a large European public cloud with many regions and a stronger IaaS and public-sector posture
Consider: OVHcloud or IONOS
Both are catalog EU clouds; IONOS also covers consumer-style web hosting.
When: You need US-centric SMB WordPress hosting already familiar to North American agencies
Consider: GoDaddy or Bluehost
Different jurisdiction. Useful only if European contracting is not a filter.
When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.